Malawi

Malawi's general personal-data regime is Part VII of the Electronic Transactions and Cyber Security Act, 2016, in force since 1 June 2017, which binds a data controller, any person who determines the purpose and manner of processing, to process personal data fairly and lawfully, collect it only for specified and legitimate purposes, keep it no longer than necessary, and process it only on a lawful basis such as the data subject's unambiguous consent, contractual necessity, or a legal obligation.

The Act also gives a data subject notice, access, and rectification or erasure rights, and requires a data controller to implement technical and organizational security measures; it sets no cross-border-transfer rule and no dedicated breach-notification duty, and states no penalty specific to a Part VII breach, so the Act's general default offence (a fine of K5,000,000 and imprisonment for seven years) applies.

Malawi separately enacted the Data Protection Act, 2024, which the Malawi Communications Regulatory Authority (MACRA) administers as the Data Protection Authority and describes as regulating, monitoring and enforcing compliance around how personal data is collected, processed, stored, and shared across sectors, covering both public and private organisations; its text is published only as a scanned image, so its lawful-basis, automated-decision, sensitive-data, cross-border-transfer, breach-notification, and penalty provisions are not described here.

Malawi has no scraping-specific statute, so general law governs each dimension separately.

The Electronic Transactions and Cyber Security Act, 2016 prohibits a person from gaining unauthorized access to, intercepting, or interfering with data, and separately makes it an offence to intentionally access or intercept data without authority or permission, or to exceed authorized access; unlike some neighbouring jurisdictions' computer-misuse laws, the offence does not require that the person defeat a security measure to gain access, so whether reading a public, unauthenticated page without logging in or accepting terms falls within accessing data 'without authority or permission' is unsettled, and no reported Malawian case has tested the point.

No Malawian court has ruled on the enforceability of a browsewrap or clickwrap terms-of-service against a scraper.

The Copyright Act, 2016 permits quotations from a lawfully published work, including newspaper press summaries, and reproduction for reporting current events, both subject to a fair-practice and extent-justified test, and separately permits critical or scientific use and personal or private single-copy use, but it has no text-and-data-mining exception, so training a model on scraped copyrighted text does not obviously fit any of the Act's permitted-use categories.

The Act protects a 'compilation of data' as an intellectual creation by reason of its selection or arrangement, but its own definition states that this protection does not extend to the data itself, so Malawi confers no sui generis database right beyond ordinary compilation copyright.

The Electronic Transactions and Cyber Security Act's personal-data provisions apply to personal data without a general carve-out for information that is publicly accessible, so scraping personal data from a public Malawian website remains subject to the Act's fair-processing, purpose-limitation and lawful-basis duties.

No Malawian statute or reported case establishes a scraping-specific unfair-competition, misappropriation or trespass doctrine, and none assigns legal weight to a robots.txt directive or imposes an AI-training-specific rule.

Malawi has no Digital Single Market-style press-publisher neighbouring right, no mandatory platform-to-publisher bargaining code, no recognized hot-news misappropriation doctrine distinct from ordinary copyright law, and no located statute or case law addressing hyperlinking or framing liability specifically; each of those dimensions is a sourced absence rather than an unresolved question.

The relevant instrument is the Copyright Act, 2016, which repealed the earlier Copyright Act, and whose section 39 permits, without the copyright owner's consent, the inclusion of quotations from a lawfully published work in another work, including quotations from newspaper articles and periodicals in the form of press summaries, subject to a fair-practice and extent-justified test.

Section 45 separately permits reproducing and making available to the public a work that can be seen or heard in the course of a current event, for the purpose of reporting on that event, to the extent justified for an informative purpose.

Neither provision is capped at a headline-length or short-extract threshold beyond the fair-practice test, and no reported Malawian decision applies either to a systematic news aggregator, as opposed to a traditional press summary or a broadcaster's current-events report.

Section 82 gives a publisher a right against facsimile reproduction of the typographical arrangement of a published edition, lasting twenty-five years from the end of the year the edition was first published, but this protects the printed page layout against photocopying, not the underlying text or headlines, so it does not reach a news aggregator's reproduction of content the way a Digital Single Market Article 15-style neighbouring right would.

The Act defines a 'compilation of data' as protected by reason of its selection or arrangement, but expressly states that this protection does not extend to the data itself, so the Act predates and has no equivalent of a machine-readable text-and-data-mining reservation.